{"cve":"CVE-2026-42236","nvd":{"published":"2026-05-04T19:16:06.337","modified":"2026-06-17T10:47:33.633","status":"Analyzed","description":"n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls. An unauthenticated remote attacker could exhaust server memory resources by sending large registration payloads, rendering the n8n instance unavailable. The MCP enable/disable toggle gates MCP access but did not restrict client registrations, meaning the endpoint is reachable regardless of whether MCP access is enabled on the instance. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-49m9-pgww-9vq6"],"products":["n8n:n8n"],"source":"nvd","synced_at":"2026-10-19T22:33:09.003606135+00:00"},"epss":{"cve":"CVE-2026-42236","score":0.00487,"percentile":0.41932,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-49m9-pgww-9vq6","url":"https://osv.dev/vulnerability/GHSA-49m9-pgww-9vq6","summary":"n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration","modified":"2026-05-08T01:51:06.134658Z","packages":[{"ecosystem":"npm","name":"n8n","purl":"pkg:npm/n8n","ranges":["<1.123.32"],"fixed":["1.123.32"]},{"ecosystem":"npm","name":"n8n","purl":"pkg:npm/n8n","ranges":[">=2.18.0 <2.18.1"],"fixed":["2.18.1"]},{"ecosystem":"npm","name":"n8n","purl":"pkg:npm/n8n","ranges":[">=2.0.0 <2.17.4"],"fixed":["2.17.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}